NACM with phase0

CDB and CDB API
1

Hi,
I would like to know if NACM is performed in phase0? my background is try to create several entities during phase0, but I don’t know if NACM is enforced during phase0.
thanks in advance.

2

AAA/NACM has not been started in phase0, but it’s kind of irrelevant - the only way you can create configuration in phase0 is by attaching to the CDB “init/upgrade transaction”, via maapi_attach_init(), and no AAA checks are done in that transaction anyway. Note that an application can always (after phase0) make configuration changes without AAA restrictions (if so desired), by using a user session with context “system” - see the documentation for maapi_start_user_session().

3

Thanks.

does validation callpoint involve in this case? I guess so.

4

Yes, validation callbacks are always invoked when a transaction that modifies any of the validation point dependencies is committed. This is true also for the CDB init/upgrade transaction, which is why you normally need to register these callbacks already in phase0. See Table 27.1. “ConfD Start Phases” in the “Advanced Topics” chapter of the User Guide. (You can of course use --ignore-initial-validation for the CDB init/upgrade transaction, but this means that you could potentially commit an invalid configuration.)

5

thanks for the information.